CloudFront & Global Accelerator

CloudFront & Global Accelerator Quick Notes

CloudFront (CDN)

• Origin: S3 or custom (ALB, on-prem, etc.).
• Edge + regional edge caches: Improve latency; some traffic skips regional edge.
• Skips regional edge: Dynamic content (forward all headers) and proxy methods PUT/POST/PATCH/OPTIONS/DELETE.
• TTL / invalidation: Prefer versioned filenames over constant invalidations.
• Certs for custom domains: Create/import in us-east-1.

Locking S3 to CloudFront

• OAI / OAC + bucket policy so only CloudFront can read.
• Restrict viewer IPs: WAF IP match on the CloudFront distribution (not SGs/NACLs “on CloudFront”).

Georestriction

• Allow/block countries on the distribution (licensing).
• Pair with Route 53 geolocation when DNS-level geography is also required.

Signed Access

Tool: Access scope

Signed URL: One object

Signed cookies: Group of objects under a path

Origin Features

• Origin groups: Primary + secondary for origin failover.
• Field-level encryption: Protect specific sensitive POST fields to the origin.
• Multiple origins: Route by path / content type.
• Custom origin to on-prem: Fast path when backend must stay in the US but users are global.

Cost Tip

• Global users downloading from S3 → put CloudFront in front (edge cache cuts origin transfer).

Global Accelerator

• Anycast entry (typically two static IPs) → AWS global backbone → your endpoints.
• Works for TCP and UDP (CloudFront is HTTP/CDN-centric).
• Fit: Global UDP apps, fast regional failover, keep custom DNS, or collapse many Regional ALB IPs into two whitelistable anycast IPs.
• Not for: Speeding S3 uploads (use S3TA / multipart).
• Blue/green with DNS caching: Dial traffic % on Global Accelerator instead of waiting on Route 53 TTLs.